New stealthy Pumakit Linux rootkit malware spotted in the wild

[Corrine]

From Bleeping Comoputer:

 

A new Linux rootkit malware called Pumakit has been discovered that uses stealth and advanced privilege escalation techniques to hide its presence on systems.

The malware is a multi-component set that includes a dropper, memory-resident executables, a kernel module rootkit, and a shared object (SO) userland rootkit.

Elastic Security discovered Pumakit in a suspicious binary ('cron') upload on VirusTotal, dated September 4, 2024, and reported having no visibility into who uses it and what it targets.

Generally, these tools are used by advanced threat actors targeting critical infrastructure and enterprise systems for espionage, financial theft, and disruption operations.

 

More at the referenced topic.

[securitybreach]

Well going by history, this will be patched within a day or two on Linux.

[securitybreach]

I just read that:

 

"it only works on kernels 5.7 or lower, even debian stable has a more recent kernel."